CVE-2025-50127

Vulnerability

An SQL injection vulnerability exists in the DJ-Flyer component versions 1.0 through 3.2 for Joomla. The component fails to properly sanitize user-supplied input, enabling an authenticated privileged user to inject arbitrary SQL commands into database queries. [1]

Exploitation

Attackers must have a Joomla account with privileged access (e.g., administrator or manager) to exploit this flaw. No special network position is required; the attack can be performed from any authenticated session by manipulating input parameters to vulnerable component functions.

Impact

Successful exploitation allows attackers to execute arbitrary SQL statements. This can lead to unauthorized reading, modification, or deletion of database contents, potentially compromising the entire Joomla installation and its data.

Mitigation

The vendor has not released a specific security advisory but users should contact DJ-Extensions for updated component versions. As a best practice, limit privileged account usage and apply any available patches.